MALICIOUS — nfe_doc-VXNTFD.hta

MALICIOUS — nfe_doc-VXNTFD.hta is a hta sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Wacatac family. 3 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 2053a83f4339fc9cb02b0d43b497024d1b998946d1f45b4b051ec7698e2a820b
SHA-1: 41885275c69c666d76adcf26e158d155ebbbf503
MD5: 5abb3f49b1780fc438b271363e7218ed
ssdeep: 48:3f3ZjwcRX5V9XdXWVZCkgoxcY+fixSbWkMugA1QIFY0NM:hjwo5V95gZCkDV+eugo/FnM
TLSH: T125168F5EEA24388BDD97236637F33EFE984194662456F4756BC63113819BD3C081C21E
Submitted as: nfe_doc-VXNTFD.hta
File type: hta · Size: 2802 bytes
Verdict: malicious (96/100) · Family: Wacatac

Detections (3 of 53 engines)

Microsoft Defender: Trojan:Script/Wacatac.C!ml
Emsisoft (Emergency Kit): Trojan.Generic.40369841
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 7 weighted signals:

3 behavioral detection(s): LOLBin: mshta executing remote/scripted payload [high] (rule tl-lolbin-mshta) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 928) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Obfuscated javascript script: dynamic-exec (layers: char-code) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Document contains macros/active content: hta-application, activex - static signal, weight 0.35, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5320 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

1125c0bed4c59ce2ee0f968c90734240528f4840f7925a13be12ecdd9bf25106 - 1125c0bed4c59ce2ee0f968c90734240528f4840f7925a13be12ecdd9bf25106

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787592049&P2=404&P3=2&P4=keBPHaCjdlGafbRW2MCKu4uTFmtXJW36NomkFtVqDiwjJBi%2f7E%2bIgYUBl0XxuAJSbsOh3GBNB1QzoeEPJf%2boKQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787592089&P2=404&P3=2&P4=JrVZ8g9voNfyUvV6ouysWGrOjwm6qMzV0DlrdE6FpPaaRZk3u%2bwzMdIPM9szMNPHEnB5RRmhearaXSx7o8bVCQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

documentos.emissaofiscal.com

Embedded IP addresses

4.150.223.96
52.230.60.54
4.230.171.124
57.154.63.210
4.247.188.224
135.232.92.137
74.179.77.164
20.42.65.84
135.233.95.80
203.26.79.13
20.76.201.171
52.123.129.14
52.123.128.14
135.233.45.223
92.223.78.30
172.178.240.162
52.148.114.188
52.182.141.63
104.208.16.94
162.159.142.9
72.154.7.108
52.110.12.30
52.110.12.11
52.110.12.10
52.110.12.55

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report